In Figure REF  (b)(c), we illustrate the effect on soft distillation and hard distillation. We use the watermark key \(K\)  to extract the output of the victim model and suspect model. The extracted model clearly follows the victim model and there is a prominent peak at frequency \(f_w\) . Note that suspect model distillation with soft labels has a higher \(P_{\text{snr}}\)  than the one with hard labels. This is because the training process of extracted models can be more effective and faster with soft labels [1]}.
